tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Separate product_service_contexts out of system sepolicy.

Browse source 
Bug: 119305624
Test: normal/recovery boot aosp_taimen
Change-Id: I15aa275fa658b58f5a5d3e651d164f9fcd87c0af
This commit is contained in:
Tri Vo 2018-12-21 12:28:14 -08:00
parent 3507678d2e
commit 6ac0896b90
2 changed files with 31 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
Android.mk
View file

@ -289,6 +289,7 @@ LOCAL_REQUIRED_MODULES += \
product_hwservice_contexts \
product_property_contexts \
product_seapp_contexts \
product_service_contexts \
endif
include $(BUILD_PHONY_PACKAGE)
@ -1493,8 +1494,7 @@ endif
include $(BUILD_SYSTEM)/base_rules.mk
# TODO(b/119305624): Move product-specific sepolicy out of plat_service_contexts.
plat_svcfiles := $(call build_policy, service_contexts, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
plat_svcfiles := $(call build_policy, service_contexts, $(PLAT_PRIVATE_POLICY))
plat_service_contexts.tmp := $(intermediates)/plat_service_contexts.tmp
$(plat_service_contexts.tmp): PRIVATE_SVC_FILES := $(plat_svcfiles)
@ -1513,6 +1513,34 @@ built_plat_svc := $(LOCAL_BUILT_MODULE)
plat_svcfiles :=
plat_service_contexts.tmp :=
##################################
include $(CLEAR_VARS)
LOCAL_MODULE := product_service_contexts
LOCAL_MODULE_CLASS := ETC
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
include $(BUILD_SYSTEM)/base_rules.mk
product_svcfiles := $(call build_policy, service_contexts, $(PRODUCT_PRIVATE_POLICY))
product_service_contexts.tmp := $(intermediates)/product_service_contexts.tmp
$(product_service_contexts.tmp): PRIVATE_SVC_FILES := $(product_svcfiles)
$(product_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
$(product_service_contexts.tmp): $(product_svcfiles)
@mkdir -p $(dir $@)
$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
$(LOCAL_BUILT_MODULE): $(product_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
@mkdir -p $(dir $@)
sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
$(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
product_svcfiles :=
product_service_contexts.tmp :=
##################################
# nonplat_service_contexts is only allowed on non-full-treble devices
ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)

1
private/file_contexts
View file

@ -378,6 +378,7 @@
/(product|system/product)/etc/selinux/product_hwservice_contexts u:object_r:hwservice_contexts_file:s0
/(product|system/product)/etc/selinux/product_property_contexts u:object_r:property_contexts_file:s0
/(product|system/product)/etc/selinux/product_seapp_contexts u:object_r:seapp_contexts_file:s0
/(product|system/product)/etc/selinux/product_service_contexts u:object_r:service_contexts_file:s0
#############################
# Product-Services files